CVE-2026-118186mediumCWE-863

CVE-2026-118186: medium-severity vulnerability in PublishPress Revisions: Duplicate Posts…

PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow

Published

Follow this CVE+ Monitor Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.9epss 0.3%
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — PublishPress Revisions: Duplicate Posts…

In the same product, most dangerous first.

CVE-2026-118187LOWPublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOREPSS 0.2%CVE-2026-118188MEDIUMPublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content DisclosureEPSS 0.2%